Circular 77/2025/TT-NHNN: Strengthening security requirements for banking services

On 31 December 2025, the Governor of the State Bank of Vietnam (“SBV”) issued Circular No. 77/2025/TT-NHNN (“Circular 77/2025”), amending and supplementing a number of provisions of Circular No. 50/2024/TT-NHNN on security and safety requirements for online services in the banking sector. This Circular takes effect from 1 March 2026.

The objective of Circular 77/2025 is to enhance the security and safety of online service systems in the context of increasingly sophisticated cybercrime, particularly fraud schemes involving deepfake technology, malware, and “shell” or fraudulent corporate accounts used to misappropriate users’ assets in cyberspace.

1. Prevention of biometric spoofing in authentication

One of the most significant amendments under Circular 77/2025 is Clause 1, Article 7, which requires credit institutions, foreign bank branches, payment intermediary service providers, and credit information companies to implement Presentation Attack Detection (“PAD”) solutions that meet the following standards:^[1]

• Certified by a laboratory recognized by the FIDO Alliance; or
• Certified by an organization accredited to issue international standard (ISO) certifications;
• Compliant with ISO 30107 Level 2 or equivalent; and
• The certifying body must be a member of the IAF Multilateral Recognition Arrangement (“IAF MLA”).

This provision clearly reflects regulatory expectations to strengthen consumer protection in the digital environment, particularly in response to the growing prevalence of high-tech fraud such as deepfake, malware, and fraudulent corporate accounts. The adoption of standardized PAD solutions helps prevent biometric spoofing attacks, thereby reducing the risk of account takeovers and asset misappropriation in online transactions. At the same time, this requirement is expected to enhance the safety and integrity of the financial and banking system, while mitigating fraud risks, financial losses, and legal and reputational risks for service providers.

In addition, Appendix 02 provides that:

• Type C and D transactions must mandatorily combine enhanced OTP with accurate biometric matching.
• For corporate customers, the biometric data must belong to the legal representative.

This reflects a shift from single-factor authentication to multi-factor authentication (“MFA”), incorporating biometric elements with anti-spoofing mechanisms.

2. Measures to mitigate “shell corporate accounts”

For the first time, Circular 77 introduces the concept of “new corporate customers” to identify higher-risk customer groups, including:^[2]

• Organizations established within the past 12 months; or
• Organizations that have newly established a relationship with the institution within the past 12 months; and
• Assessed by the institution as higher risk, requiring enhanced authentication measures.

For such customers, depending on specific circumstances, stricter online transaction verification measures must be applied, including:

• Matching biometric data of the legal representative combined with basic or dual-channel Soft OTP/Token OTP;
• Matching biometric data of the legal representative combined with enhanced Soft OTP/Token OTP, FIDO authentication, or secure electronic signatures; or
• Secure electronic signatures integrated with the organization’s digital identity account.

3. Requirements for online banking and payment applications

3.1. Security assessment and testing requirements:^[3]

• For web-based Online Banking applications: must ensure protection against at least the top 10 most common security vulnerabilities as published by OWASP (OWASP Top Ten).
• For Mobile Banking applications: must meet minimum mobile application security requirements in accordance with OWASP Mobile Application Security standards.
• The applicable OWASP standards must be the latest version or the most recently issued version within six (06) months prior to deployment.

3.2. Transaction processing requirements for customer:^[4]

• For corporate customers: application software must be designed to ensure that online payment transactions (except card payments via merchants) are carried out in at least two steps: (i) transaction initiation; and (ii) transaction approval.
• For household businesses or micro-enterprises applying simplified accounting regimes: separation of transaction initiation and approval steps is not mandatory.

3.3. Requirements for connection authentication and system integration:^[5]

• Online Banking applications must include functionality to authenticate connections with customers’ software systems in order to: (i) ensure information security and confidentiality; (ii) prevent fraud and impersonation; and (iii) comply with relevant international or Vietnamese technical standards and regulations.

Conclusion

Circular 77/2025/TT-NHNN represents an important step in improving the legal framework governing the security of online payment services in Vietnam. The introduction of international standards for biometric technologies and the strengthening of technical risk control requirements are notable highlights, demonstrating efforts to ensure the safety, security, and transparency of the digital payment system.